fix, sysctl-initramfs: switch log to /run/initramfs/sysctl-initramfs-error.log

since ephemeral, in RAM, not written to disk, no conflict with grub-live

https://forums.whonix.org/t/kernel-hardening/7296/435
This commit is contained in:
Patrick Schleizer 2020-04-16 07:54:33 -04:00
parent 701da5f6cc
commit 4898a9e753
No known key found for this signature in database
GPG Key ID: CB8D50BB77BB3C48

View File

@ -15,19 +15,12 @@ prereqs)
;;
esac
## ${rootmnt} is mounted read-only in the initramfs so it needs to be remounted first.
if mount | grep "${rootmnt}" | grep -q "(ro,"; then
remount="yes"
mount -o remount,rw "${rootmnt}"
fi
## Write to '/run/initramfs' folder.
## https://forums.whonix.org/t/kernel-hardening/7296/435
sysctl -p ${rootmnt}/etc/sysctl.conf >/dev/null 2> "${rootmnt}/var/log/sysctl-initramfs-error.log"
sysctl -p ${rootmnt}/etc/sysctl.d/*.conf >/dev/null 2>> "${rootmnt}/var/log/sysctl-initramfs-error.log"
sysctl -p ${rootmnt}/etc/sysctl.conf >/dev/null 2> "/run/initramfs/sysctl-initramfs-error.log"
sysctl -p ${rootmnt}/etc/sysctl.d/*.conf >/dev/null 2>> "/run/initramfs/sysctl-initramfs-error.log"
if [ "${remount}" = "yes" ]; then
mount -o remount,ro "${rootmnt}"
fi
grep -v "unprivileged_userfaultfd" "${rootmnt}/var/log/sysctl-initramfs-error.log"
grep -v "unprivileged_userfaultfd" "/run/initramfs/sysctl-initramfs-error.log"
true